Cybersecurity Compliance for Covered Defense Information (NIST SP 800-171)

The contract requires the implementation and documentation of NIST SP 800-171 cybersecurity controls to safeguard covered defense information held by the contractor. This includes a thorough assessment of existing security practices, identification of gaps, and the development of a Plan of Action and Milestones to address deficiencies. Self-assessments must be completed in accordance with NIST guidelines to demonstrate compliance with the specified security requirements, ensuring that all federal information systems processing, storing, or transmitting covered defense information meet the necessary protective standards. The work is tied to a subcontract under the Department of Defense, with performance specifically required at Tracy, California, 95304-5000. The solicitation, posted on July 30, 2026, has a response deadline of August 7, 2026, and is classified under NAICS code 541512 for computer systems design services. The contracting activity is managed by the ASC Commodities Division, and the effort is centered on achieving and maintaining compliance with NIST SP 800-171 standards rather than on general IT infrastructure development. Contractors must have the technical capability to conduct comprehensive cybersecurity assessments, document control implementations, and maintain accurate and up-to-date documentation for audit readiness. All deliverables must align with the Department of Defense’s requirements for protecting controlled unclassified information within subcontracted systems.